6.2

CVE-2026-59894: andialbrecht sqlparse Code Injection

CVSS: 6.2v4.0MediumDeferred
AliasesGHSA-3496-9g83-7v6xPYSEC-2026-3696UBUNTU-CVE-2026-59894
Published 17-08-2026Last modified 17-08-2026
Open JSON

Vulnerability summary

CVE-2026-59894 is a medium (CVSS 6.2) Code Injection vulnerability in andialbrecht sqlparse. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.2% of scored vulnerabilities.

Overall risk
25/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.2/10
010
Medium · v4.0 (CVE.org)
EPSS score
0.13%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 7 · Related 8
OPENSUSE-SU-2026:11557-1OPENSUSE-SU-2026:21690-1SUSE-SU-2026:23561-1SUSE-SU-2026:3762-1SUSE-SU-2026:3906-1SUSE-SU-2026:3907-1

Timeline

  1. 17-08-2026
    PublishedVulnerability first disclosed.
  2. 17-08-2026
    Last modifiedVulnerability information updated.

Description

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format='python' and output_format='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a downstream consumer executes or imports the generated source. This issue is fixed in version 0.6.0.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.13%

Chance of exploitation in the next 30 days

Percentile

2%

Versus all other CVEs

30-day change

0.00 pp

From 0.13% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.13%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard60 products
  • airflow-2< 2.11.2-r16
  • airflow-3< 3.3.1-r3
  • airflow-3-iamguarded-compatAll versions (No fix recorded)
  • airflow-core-2< 2.11.2-r7
  • apache-beam-python-3.14-sdk< 2.75.0-r2
Wolfi4 products
  • airflow-3< 3.3.1-r3
  • airflow-3-iamguarded-compatAll versions (No fix recorded)
  • mlflow< 3.16.0-r0 | < 3.15.1-r4
  • mycli< 2.16.0-r1
Andialbrecht1 product
Debian1 product
  • sqlparseAll versions (No fix recorded)
PyPI1 product
  • sqlparse< 0.6.0
Ubuntu1 product
  • sqlparseAll versions (No fix recorded)

6 vendors · 68 products

References

10 links